PATROL Agent 9.5 - Part 5: Data and event filtering

In BPPM 9.5, you can add 'Filtering Configuration' in a monitoring policy using CMA (Central Monitoring Administration).  Would this feature replace the old way you used to configure data and event filtering?

The short answer is no though you can use CMA to enhance the old way as described at the end of this post.  The 'Filtering Configuration' section in a CMA policy controls if data and events will be streamed to BPPM server or not. There are four options:

• No Filtering - the default (send all data and events)
• Filter out data (send no data, send all events)
• Filter out events (send no events, send all data)
• Filter out data and events (send no data, send no events) 

Even you select 'Filter out data and events', all data and events will still be sent to BPPM server on demand. They are just not sent as streamed.

Then how to stop sending data and events to BPPM server?  Let's take a closer look.

1) Filtering on parameter data

For data you don't need, you don't want the data being collected by PATROL KM at the first place so that you can reduce PATROL agent footprint and resource consumption.  Since CMA only allows you to control at monitoring type (application class) level, you still need to use Event Management KM to control at parameter level.  For example, if you don't want to see parameter CACcachCopyReadsPerSec, your pconfig variable settings would look like this:

"/AS/EVENTSPRING/PARAM_SETTINGS/THRESHOLDS/NT_CACHC/NT_CACHE/CACcachCopyReadsPerSec" = { REPLACE = "0,0 0 0 0 0 0,0 0 0 0 0 0,0 0 0 0 0 0" }

2) Filtering on event forwarding

For events you are not interested such as information and login events, you don't want those events being forwarded to a BPPM integration service or cell. You need to create some pconfig variable settings to activate and deactivate event types.  For example, if you only want to forward type 11 events (value of parameter is in alarm zone) and Notify Events, your pconfig variable settings would look like this:

/EventSetup/Format/BiiP3/catalogs/0/active = { REPLACE = "0"},
/EventSetup/Format/BiiP3/catalogs/0/types/11/active = { REPLACE = "1"},
/EventSetup/Format/BiiP3/catalogs/0/types/11/KM/AS_EVENTSPRING/active = { REPLACE = "0"},
/EventSetup/Format/BiiP3/catalogs/AS_EVENTSPRING/types/NOTIFY_EVENT/active = { REPLACE = "1"}

In the old way, you would save the pconfig settings for the above two cases in PCM (PATROL Configuration Manager) and push them manually to each PATROL agent they apply.  With CMA of BPPM 9.5, you can continue using PCM, or you can save them in 'Configuration Variables' section of a CMA policy so that they will automatically apply to all PATROL agents with matching tags.